You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Intune lets you manage your workforce's devices and apps and how they access your company data. To use this mobile device management (MDM), the devices must first be enrolled in the Intune service. When a device is enrolled, it's issued an MDM certificate. This certificate is used to communicate with the Intune service.
38
+
To use Microsoft Intune as your mobile device management (MDM) provider, you must enroll devices in Intune using a supported enrollment method. Enrollment sets up and secures the device so that it aligns with your organization's policies and is suitable for use at work or school. Intune deploys and enforces policies through a management profile, which is installed on the device during enrollment. Enrollment is enabled for all platforms by default.
39
39
40
-
As you can see in the following tables, there are several methods to enroll your workforce's devices. Each method depends on the device's ownership (personal or corporate), device type (iOS, Windows, Android), and management requirements (resets, affinity, locking).
40
+
Microsoft Intune supports Android, macOS, iOS, and Windows devices. Some enrollment methods require you, as the IT administrator, to initiate enrollment while other methods require your employees or students to initiate it. This article provides an overview of the types of devices and enrollment methods that Intune supports.
41
41
42
-
By default, devices for all platforms are allowed to enroll in Intune. However, you can [restrict devices by platform](enrollment-restrictions-set.md#create-a-device-platform-restriction) in Intune.
42
+
## Supported device types
43
+
Microsoft Intune enables mobile device management for:
44
+
* Personal devices, including personally owned phones, tablets, and PCs.
45
+
* Corporate-owned devices, including phones, tablets, and PCs owned by your organization and distributed to employees and students for use at work or school.
43
46
44
-
## iOS/iPadOS enrollment methods
47
+
### Personal devices
48
+
Microsoft Intune supports bring-your-own-device, or *BYOD*, enrollment. This type of enrollment enables employees and students to use their personal devices for work or school things. As the admin, you're required to add device users in the Microsoft Endpoint Manager admin center, configure their enrollment experience, and set up Intune policies. Enrollment is initiated and completed by the device user in the Intune Company Portal app.
|Method used to enroll devices. |If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. |More information about method. |
49
-
|**[BYOD](#bring-your-own-device)**| No| Yes | No |[More information](apple-mdm-push-certificate-get.md)|
50
-
|**[DEM](#device-enrollment-manager)**| No |No |No |[More information](device-enrollment-manager-enroll.md)|
|Method used to enroll devices. |If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. |More information about method. |
60
-
|**[BYOD](#bring-your-own-device)**| No| Yes | No |[More information](macos-enroll.md)|
61
-
|**[DEM](#device-enrollment-manager)**| No |No |No |[More information](device-enrollment-manager-enroll.md)|
Microsoft Intune automatically marks certain devices as *corporate-owned*. This classification lets you manage and configure devices with more control and access. For more information about managing and configuring corporate-owned devices, see [Identify devices as corporate-owned](corporate-identifiers-add.md).
|Method used to enroll devices. | If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. | More information about method. |
69
-
|**[BYOD](#bring-your-own-device)**| No | Yes | No |[More information](windows-enroll.md)|
70
-
|**[DEM](#device-enrollment-manager)**| No |No |No |[More information](device-enrollment-manager-enroll.md)|
71
-
|**Auto-enroll**| No |Yes |No |[More information](windows-enroll.md#enable-windows-automatic-enrollment)|
Enrollment options vary by operating system (OS). When selecting a method, choose one that works with the devices and features you want to support.
60
+
61
+
In this section, we'll use data tables to compare the available methods. Each table, separated by OS, shows the following data:
62
+
63
+
* Method: The enrollment method used to enroll devices in Intune.
64
+
* Enrollment type (Android): The name of the Android enrollment type.
65
+
* Reset required: Tells you if devices are reset to factory default settings during enrollment. Options:
66
+
***Yes**: Existing data is wiped from devices during enrollment.
67
+
***No**: Existing data is retained on devices during enrollment.
68
+
* User affinity: Tells you whether devices are associated with users during enrollment. Options:
69
+
***Yes**: Each device is associated with an Intune-licensed user.
70
+
***No**: Devices aren't associated with a user during enrollment, which is a typical configuration for kiosk, point of sale (POS), or shared-utility devices.
71
+
***Optional**: Microsoft Intune makes this setting available for you to configure on your own.
72
+
* MDM profile removable: Tells you if users can remove the MDM profile from an enrolled device. Options:
73
+
***Yes**: Device users cannot unenroll devices.
74
+
***No**: Device users can unenroll devices.
75
+
***Configurable via policy** (Android Enterprise): There's a setting in Intune that lets you block factory resets on devices, which prevents users from unenrolling their devices, but it is not configured by default.
76
76
77
-
## Android enrollment methods
77
+
### iOS/iPadOS enrollment methods
78
+
You can use the following methods to enroll iOS/iPadOS devices in Intune:
|Name of enrollment type. |Method used to enroll devices.| If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. |More information about method. |
84
-
|**Android Device Admin**|**User initiated via Company Portal**| No | Yes | No |[More information](../user-help/enroll-device-android-company-portal.md)|
85
-
|**Android Enterprise personally-owned with Work Profile**|**User initiated via Company Portal**| No | Yes | No |[More information](android-work-profile-enroll.md)|
|Name of enrollment type. |Method used to enroll devices.| If yes, devices are wiped during enrollment. | If yes, each device is associated with a user.| If yes, users can't unenroll devices. |More information about method. |
92
-
|**Android (AOSP) user-associated**|**QR code**|Yes|Yes|Configurable via policy|[More information](../enrollment/android-aosp-corporate-owned-user-associated-enroll.md)
93
-
|**Android (AOSP) userless**|**QR code**|Yes|No|Configurable via policy|[More information](../enrollment/android-aosp-corporate-owned-userless-enroll.md)
94
-
|**Android Device Admin**|**[DEM](#device-enrollment-manager) initiated via Company Portal**| No | No | No |[More information](device-enrollment-manager-enroll.md)|
95
-
|**Android Device Admin**|**(Pre-declared IMEI or SN) User initiated via Company Portal**| No | Yes | No |[More information](corporate-identifiers-add.md)|
96
-
|**Android Device Admin with Zebra Mobility Extensions**|**User or [DEM](#device-enrollment-manager) initiated via Company Portal**| No | Yes if user initiated, No if [DEM](#device-enrollment-manager) initiated | No |[More information](../configuration/android-zebra-mx-overview.md)|
97
-
|**Android Enterprise Dedicated**|**NFC, Token, QR code, Zero Touch**| Yes | No | Configurable via policy |[More information](android-kiosk-enroll.md)|
98
-
|**Android Enterprise Fully Managed**|**NFC, Token, QR code, Zero Touch**| Yes | Yes | Configurable via policy |[More information](android-dedicated-devices-fully-managed-enroll.md)|
99
-
|**Android Enterprise corporate-owned with Work Profile**|**NFC, Token, QR code, Zero Touch**| Yes | Yes | Configurable via policy |[More information](android-corporate-owned-work-profile-enroll.md)|
96
+
### macOS enrollment methods
97
+
You can use the following methods to enroll macOS devices in Intune:
100
98
101
-
## Bring your own device
99
+
* Bring-your-own-device (BYOD)
100
+
* Device enrollment manager
101
+
* Apple Automated Device Enrollment
102
102
103
-
Bring your own devices (BYOD) include personally-owned phones, tablets, and PCs. Users install and run the Company Portal app to enroll BYODs. This program lets users access company resources like email.
For more information about the macOS enrollment methods supported in Intune, see [Set up enrollment for macOS devices](macos-enroll.md).
106
110
107
-
[Corporate-owned devices (COD)](corporate-identifiers-add.md) include phones, tablets, and PCs owned by the organization and distributed to the workforce. COD enrollment supports scenarios like automatic enrollment, shared devices, or pre-authorized enrollment requirements. A common way to enroll CODs is for an administrator or manager to use the device enrollment manager (DEM). iOS/iPadOS devices can be enrolled directly through the ADE tools that are provided by Apple. Devices with an IMEI number can also be identified and tagged as corporate-owned.
111
+
### Windows enrollment methods
112
+
You can use the following methods to enroll Windows devices in Intune:
108
113
109
-
### Device enrollment manager
114
+
* Bring-your-own-device (BYOD)
115
+
* Device enrollment manager
116
+
* Automatic enrollment via MDM
117
+
* Automatic enrollment via Group Policy
118
+
* Windows Autopilot
119
+
* Bulk enrollment
120
+
* Co-management with Microsoft Intune and Configuration Manager
110
121
111
-
Device enrollment manager (DEM) is a special user account that's used to enroll and manage multiple corporate-owned devices. Managers can install the Company Portal and enroll many user-less devices. These types of devices are good for point-of-sale or utility apps, for example, but not for users who need to access email or company resources. Learn more about [DEM](device-enrollment-manager-enroll.md).
|Automatic enrollment via Group Policy|No |Yes |No |
128
+
|Windows Autopilot |Yes |Yes |No |
129
+
|Bulk enrollment |No |No |No |
130
+
|Co-management |No |Yes |No |
112
131
113
-
### Apple Automated Device Enrollment
132
+
For more information about the Windows enrollment methods supported in Intune, see [Enrollment methods for Windows devices ](windows-enrollment-methods.md).
114
133
115
-
Apple Automated Device Enrollment (ADE) management lets you create and deploy policy "over the air" to iOS/iPadOS and macOS devices that are purchased and managed with ADE. The device is enrolled when users turn on the device for the first time and run Setup Assistant. This method supports iOS/iPadOS supervised mode, which enables a device to be configured with specific functionality.
134
+
### Android enrollment methods
116
135
117
-
Learn more about iOS/iPadOS ADE enrollment:
136
+
To select the appropriate enrollment method for Android devices, consider the enrollment type you'll use and the device's ownership status (personal versus corporate-owned). For more information about the Android enrollment methods supported in Intune, see [Enroll Android devices](android-enroll.md).
118
137
119
-
-[Choose how to enroll iOS/iPadOS devices](ios-enroll.md)
120
-
-[Enroll iOS/iPadOS devices using Device Enrollment Program](device-enrollment-program-enroll-ios.md)
138
+
#### Personal Android devices
139
+
You can set up user-initiated enrollment for people who want to use their personal devices at work or school. Employees and students initiate enrollment by signing into the Company Portal app with their work or school account.
121
140
122
-
### USB-SA
141
+
Intune supports the following device management configurations on personal devices:
123
142
124
-
IT admins use Apple Configurator, through USB, to prepare each corporate-owned device manually for enrollment using Setup Assistant. The IT admin creates an enrollment profile and exports it to Apple Configurator. When users receive their devices, they're then prompted to run Setup Assistant to enroll their device. This method supports **iOS supervised** mode, which in turn enables the following features:
143
+
* Android Device Administrator (also referred to as *Android Device Admin*)
144
+
* Android Enterprise with work profile
125
145
126
-
- Locked enrollment
127
-
- Kiosk mode and other advanced configurations and restrictions
146
+
In the table, this data is shown in the Enrollment type column.
128
147
129
-
Learn more about iOS/iPadOS Apple Configurator enrollment with Setup Assistant:
|Android Device Admin|User-initiated via Company Portal | No | Yes | No |
151
+
|Android Enterprise, personal-owned with work profile|User-initiated via Company Portal| No | Yes | No |
152
+
153
+
#### Corporate-owned Android devices
154
+
Intune supports the following device management configurations on corporate-owned devices:
155
+
156
+
* User associated and userless devices created from Android Open Source Project (AOSP)
157
+
* Android Device Administrator (also referred to as *Android Device Admin*)
158
+
* Android Device Admin with Zebra Mobility Extensions
159
+
* Android Enterprise dedicated/kiosk-style
160
+
* Android Enterprise fully managed
161
+
* Android Enterprise with work profile
130
162
131
-
-[Decide how to enroll iOS/iPadOS devices](ios-enroll.md)
132
-
-[Enroll iOS/iPadOS devices with Configurator and Setup Assistant](apple-configurator-enroll-ios.md)
163
+
In the table, this data is shown in the Enrollment type column. You can use the following methods to enroll corporate-owned Android devices in Intune:
133
164
134
-
### USB-Direct
135
-
For direct enrollment, the admin must enroll each device manually by creating an enrollment policy and exporting it to Apple Configurator. USB-connected, corporate-owned devices are enrolled directly and don't require a wipe. Devices are managed as user-less devices. They're not locked or supervised and can't support Conditional Access, jailbreak detection, or mobile application management.
165
+
* QR code
166
+
* Device enrollment manager (DEM) with Company Portal
|Android (AOSP) user-associated|QR code|Yes|Yes|Configurable via policy|
175
+
|Android (AOSP) userless|QR code|Yes|No|Configurable via policy|
176
+
|Android Device Admin|DEM-initiated via Company Portal| No | No | No |
177
+
|Android Device Admin|User-initiated via Company Portal with predeclared IMEI or serial number | No | Yes | No |
178
+
|Android Device Admin with Zebra Mobility Extensions|User or DEM-initiated via Company Portal| No | Yes if user-initiated; no if DEM-initiated | No |
179
+
|Android Enterprise dedicated|NFC, token, QR code, Google zero-touch| Yes | No | Configurable via policy |
180
+
|Android Enterprise fully managed|NFC, token, QR code, Google zero-touch| Yes | Yes | Configurable via policy |
181
+
|Android Enterprise corporate-owned with work profile| NFC, token, QR code, Google zero-touch | Yes | Yes | Configurable via policy |
136
182
137
-
To learn more about iOS/iPadOS enrollment, see:
183
+
## Mobile device record cleanup
138
184
139
-
-[Decide how to enroll iOS/iPadOS devices](ios-enroll.md)
140
-
-[Enroll iOS/iPadOS devices with Configurator and direct enrollment](apple-configurator-enroll-ios.md)
185
+
The MDM certificate renews automatically as long as enrolled devices are communicating with the Microsoft Intune service. The MDM certificate doesn't renew for devices that have been wiped, or that fail to sync with Microsoft Intune for an extended period of time. Microsoft Intune deletes idle devices from record 180 days after the MDM certificate expires.
141
186
142
-
## Mobile device cleanup after MDM certificate expiration
187
+
## Next steps
143
188
144
-
The MDM certificate is renewed automatically when mobile devices are communicating with the Intune service. If mobile devices are wiped, or they fail to communicate with the Intune service for some period of time, the MDM certificate isn't renewed. The device is removed from the Azure portal 180 days after the MDM certificate expires.
189
+
You can adjust the settings in Intune to restrict specific platforms from enrolling. For more information, see [Create a device platform restriction](enrollment-restrictions-set.md#create-a-device-platform-restriction).
0 commit comments